hwc: fix crop validation issue in copybit.

While calculation of actual src or dst crop for mdp3,
values may go in -ve.

CRs-Fixed: 769741
Change-Id: Ief0fff0cb518f473bd24d04936e97c771e95cb5f

1 files changed, 11 insertions, 2 deletions

diff --git a/libcopybit/copybit.cpp b/libcopybit/copybit.cpp
index e4624e0b..b182e4c8 100644
--- a/libcopybit/copybit.cpp
+++ b/libcopybit/copybit.cpp
@@ -122,6 +122,10 @@ static void intersect(struct copybit_rect_t *out,
     out->b = min(lhs->b, rhs->b);
 }
 
+static bool validateCopybitRect(struct copybit_rect_t *rect) {
+    return ((rect->b > rect->t) && (rect->r > rect->l)) ;
+}
+
 /** convert COPYBIT_FORMAT to MDP format */
 static int get_format(int format) {
     switch (format) {
@@ -161,7 +165,7 @@ static void set_image(struct mdp_img *img, const struct copybit_image_t *rhs)
     img->memory_id  = hnd->fd;
 }
 /** setup rectangles */
-static void set_rects(struct copybit_context_t *dev,
+static bool set_rects(struct copybit_context_t *dev,
                       struct mdp_blit_req *e,
                       const struct copybit_rect_t *dst,
                       const struct copybit_rect_t *src,
@@ -169,6 +173,9 @@ static void set_rects(struct copybit_context_t *dev,
     struct copybit_rect_t clip;
     intersect(&clip, scissor, dst);
 
+    if (!validateCopybitRect(&clip))
+       return false;
+
     e->dst_rect.x  = clip.l;
     e->dst_rect.y  = clip.t;
     e->dst_rect.w  = clip.r - clip.l;
@@ -212,6 +219,7 @@ static void set_rects(struct copybit_context_t *dev,
             e->src_rect.x = (src->l + src->r) - (e->src_rect.x + e->src_rect.w);
         }
     }
+    return true;
 }
 
 /** setup mdp request */
@@ -520,7 +528,8 @@ static int stretch_copybit(
             set_infos(ctx, req, flags);
             set_image(&req->dst, dst);
             set_image(&req->src, src);
-            set_rects(ctx, req, dst_rect, src_rect, &clip);
+            if (set_rects(ctx, req, dst_rect, src_rect, &clip) == false)
+                continue;
 
             if (req->src_rect.w<=0 || req->src_rect.h<=0)
                 continue;